Iranian hacking group APT42: Crooked Charms, Cons, and Compromises

guest · Sep 7, 2022

New Iranian hacking group APT42 deploys custom Android spyware
By Bill Toulas @billtoulas - September 7, 2022

A new Iranian state-sponsored hacking group known as APT42 has been discovered using a custom Android malware to spy on targets of interest.

The cybersecurity firm has collected enough evidence to determine that APT42 is a state-sponsored threat actor who engages in cyberespionage against individuals and organizations of particular interest to the Iranian government.
Click to expand...

APT42's first signs of activity date back to seven years ago and revolve around lengthy spear-phishing campaigns that targeted government officials, policymakers, journalists, academics across the globe, and Iranian dissidents.

The hackers' goal is to steal account credentials. However, in many cases, they also deploy a custom Android malware strain capable of tracking victims, accessing the device's storage, and extracting communication data.
Click to expand...

Campaigns and targets
According to Mandiant, who discovered the activities of the new hacking group, APT42 has conducted at least 30 operations in 14 countries since 2015. However, this is likely only a small part that surfaced due to operation security mistakes that allowed them to be tracked.
Click to expand...

Mandiant: APT42: Crooked Charms, Cons, and Compromises

Today, Mandiant is releasing a comprehensive report detailing APT42, an Iranian state-sponsored cyber espionage group tasked with conducting information collection and surveillance operations against individuals and organizations of strategic interest to the Iranian government. We estimate with moderate confidence that APT42 operates on behalf of the Islamic Revolutionary Guard Corps (IRGC)’s Intelligence Organization (IRGC-IO) based on targeting patterns that align with the organization’s operational mandates and priorities.

Read the APT42 report now, and check out our podcast for even more information on APT42.
Click to expand...

APT42 operations broadly fall into three categories:

Credential harvesting: APT42 frequently targets corporate and personal email accounts through highly targeted spear-phishing campaigns with enhanced emphasis on building trust and rapport with the target before attempting to steal their credentials.

Surveillance operations: As of at least late 2015, a subset of APT42’s infrastructure served as command-and-control (C2) servers for Android mobile malware designed to track locations, monitor communications, and generally surveil the activities of individuals of interest to the Iranian government, including activists and dissidents inside Iran.

Malware deployment: While APT42 primarily prefers credential harvesting over activity on disk, several custom backdoors and lightweight tools complement its arsenal. The group likely incorporates these tools into their operations when the objectives extend beyond credential harvesting.

Click to expand...

Log in or Sign up

Iranian hacking group APT42: Crooked Charms, Cons, and Compromises

guest Guest

Log in or Sign up

Iranian hacking group APT42: Crooked Charms, Cons, and Compromises

guest Guest

Useful Searches